Overview

overview

10

Static

static

windows_x6...pt.dll

windows10-1703-x64

10

Analysis

  • max time kernel
    252s
  • max time network
    223s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    24-08-2022 01:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    windows_x64_encrypt.dll

  • Size

    601KB

  • MD5

    5a22a872d458c1dcb66cc2506d57afb7

  • SHA1

    5dbdd31a29f702b317d7907a69a42e7d21a5b32e

  • SHA256

    940f22327b5693b1246187f49e87e0ebbd01454033029c7aa6eab15a0ae85fa9

  • SHA512

    6ffe0696aff39449e110811c2f862f835cbd51e46942b9a9cef987e4d24ac9d9efdc9a32102d76df433b423004c8d194e6d23e5369f109449917b0b55ade9845

  • SSDEEP

    12288:O4jAC6F/0doKJcT/L/DcQVV03YKHLbdOrqoeOQB8eA2wmuKE6bxmdemEll6/vTF+:O4jF05/XPnEbynuLEhAoFci4HksWld9E

Score
10/10
hiveevasionransomwarespywarestealer

Malware Config

Extracted

Path

C:\HOW_TO_DECRYPT.txt

Family

hive

Ransom Note
Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data and to prevent exfiltrated files to be disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: f4swBDMf1oJe Password: 8uwzKs2qSfZSNfHco6A6 To get an access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete *.key files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. - Do not reject to purchase. Exfiltrated files will be publicly disclosed.
URLs

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

Signatures

  • Hive

    A ransomware written in Golang first seen in June 2021.

    ransomwarehive
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Deletes System State backups 3 TTPs 2 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Modifies extensions of user files 6 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies data under HKEY_USERS 5 IoCs
  • Modifies registry class 18 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\windows_x64_encrypt.dll,#1
    1⤵
      PID:1772
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 1772 -s 476
        2⤵
        • Program crash
        PID:2164
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      1⤵
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:4276
      • C:\Windows\system32\rundll32.exe
        rundll32 windows_x64_encrypt.dll,Open -u f4swBDMf1oJe:8uwzKs2qSfZSNfHco6A6
        2⤵
        • Modifies extensions of user files
        • Enumerates connected drives
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4260
        • C:\Windows\System32\vssadmin.exe
          "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
          3⤵
          • Interacts with shadow copies
          PID:8080
        • C:\Windows\System32\wbem\WMIC.exe
          "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:8104
        • C:\Windows\System32\notepad.exe
          "C:\Windows\System32\notepad.exe" C:\HOW_TO_DECRYPT.txt
          3⤵
          • Opens file in notepad (likely ransom note)
          PID:8092
        • C:\Windows\System32\wbadmin.exe
          "C:\Windows\System32\wbadmin.exe" delete systemstatebackup
          3⤵
          • Deletes System State backups
          • Drops file in Windows directory
          PID:8100
        • C:\Windows\System32\wbadmin.exe
          "C:\Windows\System32\wbadmin.exe" delete catalog-quiet
          3⤵
            PID:8244
          • C:\Windows\System32\bcdedit.exe
            "C:\Windows\System32\bcdedit.exe" /set {default} recoveryenabled No
            3⤵
            • Modifies boot configuration data using bcdedit
            PID:8352
          • C:\Windows\System32\bcdedit.exe
            "C:\Windows\System32\bcdedit.exe" /set {default} bootstatuspolicy ignoreallfailures
            3⤵
            • Modifies boot configuration data using bcdedit
            PID:8408
          • C:\Windows\System32\wbadmin.exe
            "C:\Windows\System32\wbadmin.exe" delete systemstatebackup -keepVersions:3
            3⤵
            • Deletes System State backups
            PID:8428
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:8500
      • C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
        1⤵
        • Drops file in Windows directory
        • Enumerates system info in registry
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:8784

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\HOW_TO_DECRYPT.txt
        Filesize

        1KB

        MD5

        20bdd0550a456bce8e13c274b664773a

        SHA1

        fb0cc4524af1a037a86894674a0bc35c131d4541

        SHA256

        9c7bc541a871e58404ec31e4b2472343321af96fcc0e789177f460ce0b33ac9e

        SHA512

        3e774427b55fe014d00e947d57e933eeb90f934ecb58213e3b161b0bf4cb5cc02973f84134e85133c9d9f3bb297616a91ce06f8437ca35d6dc5ec6997b53fbc0

        Download Submit